CVE-2026-80645 - Vulnerability Details

- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

Description

In the Linux kernel, the following vulnerability has been resolved:

rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

With a list_for_each() loop, if we don't find the item we are looking for
in the list, then the loop exits with the iterator, which is "dbell" in
this loop, pointing to invalid memory.

This code uses the "found" variable to determine if we have found the
doorbell we are looking for or not. However, the problem that the "found"
variable needs to be set to false at the start of each iteration,
otherwise after the first correct doorbell, then everything is marked as
found.

Reset the "found" to false at the start of the iteration and move the
variable inside the loop.

Published: 2026-08-28

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The RapidIO TSI721 driver contains a logic error in its database processing routine. During a list traversal, a boolean flag is not reset for each iteration, causing the loop to incorrectly believe an entry was found even when it was not. As a result, the kernel may dereference an invalid pointer, leading to a kernel crash or potential denial of service. This defect is an invalid memory reference flaw, corresponding to CWE-824.

Affected Systems

Linux kernel installations that include the RapidIO TSI721 driver are vulnerable. Specific affected versions are not publicly listed.

Risk and Exploitability

The likely attack vector involves interacting with the RapidIO interface to trigger the faulty doorbell handling path; an attacker with sufficient privileges could cause a kernel crash. The CVSS score is 8.1, indicating a high severity, while the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits. The exploit would require the capability to reach the RapidIO driver path, after which a crash could be induced.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< 9e775c3199903d7c09a52530042b1198eab705bd
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< 81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< 13092966ba5d8fb214a4efeddc87f9ed0fd2f945
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< acd54f42abbbd806464468838dbc04efd203d2be
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< 3b5c66e922aa6a3331915a14520848a5b3beccc7
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< 070f356ea4f419e4e85e4089381f4477f41d969e
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< dc28a14f3e4546b2b06098d24177942540581a5f
`48618fb4e522d9d02e217ac05f52749545c1af20`	affected	< fc15e3a30ddd950f009c76765331783b9af94a87

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[48618fb4e522d9d02e217ac05f52749545c1af20,9e775c3199903d7c09a52530042b1198eab705bd)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,13092966ba5d8fb214a4efeddc87f9ed0fd2f945)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,acd54f42abbbd806464468838dbc04efd203d2be)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,3b5c66e922aa6a3331915a14520848a5b3beccc7)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,070f356ea4f419e4e85e4089381f4477f41d969e)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,dc28a14f3e4546b2b06098d24177942540581a5f)`	affected	code_commit	—
`[48618fb4e522d9d02e217ac05f52749545c1af20,fc15e3a30ddd950f009c76765331783b9af94a87)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.2`	affected	generic	—
`[0,3.2)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that resets the found flag in tsi721_db_dpc() and rebuild the kernel
If the RapidIO TSI721 device is not required, disable the driver or block user access so the fault cannot be triggered
Monitor system logs for RapidIO errors or kernel panics and apply any future updates promptly

Generated by OpenCVE AI on September 2, 2026 at 05:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00259.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/070f356ea4f419e4e85e4089381f4477f41d969e
https://git.kernel.org/stable/c/13092966ba5d8fb214a4efeddc87f9ed0fd2f945
https://git.kernel.org/stable/c/3b5c66e922aa6a3331915a14520848a5b3beccc7
https://git.kernel.org/stable/c/81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43
https://git.kernel.org/stable/c/9e775c3199903d7c09a52530042b1198eab705bd
https://git.kernel.org/stable/c/acd54f42abbbd806464468838dbc04efd203d2be
https://git.kernel.org/stable/c/dc28a14f3e4546b2b06098d24177942540581a5f
https://git.kernel.org/stable/c/fc15e3a30ddd950f009c76765331783b9af94a87
https://lore.kernel.org/linux-cve-announce/2026082842-CVE-2026-80645-65e4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80645
https://www.cve.org/CVERecord?id=CVE-2026-80645

History

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Tue, 01 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026082842-CVE-2026-80645-65e4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80645 https://www.cve.org/CVERecord?id=CVE-2026-80645
Metrics	threat_severity `None`	threat_severity `Moderate`

Sat, 29 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sat, 29 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Sat, 29 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}`

Fri, 28 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() With a list_for_each() loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid memory. This code uses the "found" variable to determine if we have found the doorbell we are looking for or not. However, the problem that the "found" variable needs to be set to false at the start of each iteration, otherwise after the first correct doorbell, then everything is marked as found. Reset the "found" to false at the start of the iteration and move the variable inside the loop.
Title		rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/070f356ea4f419e4e85e4089381f4477f41d969e https://git.kernel.org/stable/c/13092966ba5d8fb214a4efeddc87f9ed0fd2f945 https://git.kernel.org/stable/c/3b5c66e922aa6a3331915a14520848a5b3beccc7 https://git.kernel.org/stable/c/81c06ef66c3ab6eeaa72eb790c90ae043cdb3d43 https://git.kernel.org/stable/c/9e775c3199903d7c09a52530042b1198eab705bd https://git.kernel.org/stable/c/acd54f42abbbd806464468838dbc04efd203d2be https://git.kernel.org/stable/c/dc28a14f3e4546b2b06098d24177942540581a5f https://git.kernel.org/stable/c/fc15e3a30ddd950f009c76765331783b9af94a87

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:48:55.678Z

Updated: 2026-08-29T06:21:40.217Z

Reserved: 2026-08-26T14:34:25.778Z

Link: CVE-2026-80645

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:49.423

Modified: 2026-08-29T07:16:47.893

Link: CVE-2026-80645

Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80645 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-02T05:30:08Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object